A tampered version of Anthropic’s Claude Code extension was available in Cursor’s extension marketplace for about 11 hours on October 29, carrying code designed to give an attacker remote access to developers’ computers. Cursor, which makes an AI code editor built on Microsoft’s open-source Visual Studio Code, said at most 5,000 users were affected and that it would contact them directly.
The package, labeled version 2.1.313, was available from about 2:27 a.m. to 1:35 p.m. Pacific time. Cursor said Anthropic did not develop it, but its notice does not say how a malicious build came to be published under the extension’s official name, and Anthropic has not published a statement on the incident. Cursor said it had no evidence that other versions or the official distribution were affected. OpenSourceMalware, which tracks malicious open-source packages and analyzed this one, said the Claude Code releases on npm, Open VSX and Microsoft’s Visual Studio Code Marketplace were not malicious.
The attackers left the extension’s normal code intact and inserted a 66-line loader at the top of its main JavaScript file, so the malicious code ran as soon as the extension loaded, without the user opening a Claude Code session. It added an attacker’s key labeled “svc-telemetry” to the user’s list of authorized SSH keys, tried to switch on the computer’s SSH service and opened a reverse tunnel to the attacker’s server, retrying roughly every minute. To survive reboots, it installed a macOS LaunchAgent named com.apple.sysmond, which is not an Apple component, or on Windows a scheduled task named SysMon or a startup script.
The code also sent the attacker the computer’s hostname, username, operating system, public IP address and Git email address, along with the names of up to 40 environment variables that looked like credentials. It did not send their values. Phorion, a security firm that also analyzed the package, said the list gave the operator an inventory of which cloud credentials and tokens sat on each machine.
On most Mac and Windows computers, the remote access step would have failed. Turning on SSH requires administrator rights the extension usually lacks, and Cursor said the step would fail outside “highly unusual circumstances” in which Cursor was started with administrator privileges. Phorion found that the macOS code checked whether Remote Login was on without administrator rights, received an error instead of a status and skipped the step. The key, the persistence and the data transfer still went through, and Phorion noted that a machine with SSH already running, or turned on later, would be reachable.
Cursor said it removed the package, shut down its extension marketplace, found no other tampered extensions, rotated its keys and rebuilt the marketplace before bringing it back online. It also had the hosting provider take the attacker’s server offline.
Users who installed or updated the extension from Cursor during the window can check for the svc-telemetry key with commands Cursor published, along with cleanup scripts. Uninstalling the extension may not be enough, because the payload leaves its own scripts running. Cursor advised isolating affected machines and rotating any credentials they could reach, from a separate trusted system.
The incident follows research published this month showing that instruction files planted in a Downloads folder can take control of AI coding agents.
Sources: Cursor, Phorion, OpenSourceMalware
–
By the Control Plane Editorial Team